[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ET5AVGDTB0JCX2KJYH44WN":3,"skill-same:01M6ET5AVGDTB0JCX2KJYH44WN":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":14,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6ET5AVGDTB0JCX2KJYH44WN","configuring-suricata-for-network-monitoring",null,"Deploys and configures Suricata IDS\u002FIPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fconfiguring-suricata-for-network-monitoring\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"network monitoring","monitoring","network","configuring suricata for network monitoring","suricata","de","security","time","cm","threat","real-time","network-monitoring","ips","ids","network-security","eve","logging","pr","siem","cybersecurity","2026-11-10 10:12:30",false,"---\nname: configuring-suricata-for-network-monitoring\ndescription: 'Deploys and configures Suricata IDS\u002FIPS with Emerging Threats rulesets,\n  EVE JSON logging, and custom rules for real-time network traffic inspection, threat\n  detection, and integration with SIEM platforms for centralized security monitoring.\n\n  '\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- network-security\n- suricata\n- ids\n- ips\n- network-monitoring\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1071.001\n- T1572\n- T1048\n- T1573.001\n---\n# Configuring Suricata for Network Monitoring\n\n## When to Use\n\n- Deploying a high-performance IDS\u002FIPS capable of multi-threaded packet processing for 10+ Gbps network links\n- Monitoring network traffic with protocol-aware inspection for HTTP, TLS, DNS, SMB, and other protocols\n- Generating structured EVE JSON logs for direct SIEM ingestion without custom parsers\n- Running in inline (IPS) mode to actively block malicious traffic at network choke points\n- Combining signature-based detection with protocol anomaly detection and file extraction\n\n**Do not use** as a standalone security solution without complementary controls, for encrypted traffic inspection without TLS decryption capabilities, or on systems with insufficient CPU\u002Fmemory for the expected traffic volume.\n\n## Prerequisites\n\n- Suricata 7.0+ installed from PPA or source (`suricata --build-info`)\n- Network interface on a span port, tap, or inline bridge for traffic capture\n- AF_PACKET or DPDK support for high-performance packet capture\n- Emerging Threats Open or Pro ruleset subscription (or Snort Talos rules via oinkcode)\n- suricata-update tool for automated rule management\n- Elasticsearch\u002FKibana or Splunk for log analysis and visualization\n\n## Workflow\n\n### Step 1: Install Suricata and Dependencies\n\n```bash\n# Install from PPA (Ubuntu\u002FDebian)\nsudo add-apt-repository ppa:oisf\u002Fsuricata-stable\nsudo apt update\nsudo apt install -y suricata suricata-update jq\n\n# Verify installation\nsuricata --build-info | grep -E \"Version|AF_PACKET|NFQueue\"\n\n# Or install from source for latest features\nsudo apt install -y libpcre2-dev build-essential autoconf automake libtool \\\n  libpcap-dev libnet1-dev libyaml-dev libjansson-dev libcap-ng-dev \\\n  libmagic-dev libnetfilter-queue-dev libhiredis-dev rustc cargo cbindgen\ngit clone https:\u002F\u002Fgithub.com\u002FOISF\u002Fsuricata.git\ncd suricata && git clone https:\u002F\u002Fgithub.com\u002FOISF\u002Flibhtp.git -b 0.5.x\n.\u002Fautogen.sh && .\u002Fconfigure --prefix=\u002Fusr --sysconfdir=\u002Fetc --localstatedir=\u002Fvar \\\n  --enable-nfqueue --enable-af-packet\nmake -j$(nproc) && sudo make install install-conf\n```\n\n### Step 2: Configure Network Interfaces\n\n```bash\n# Disable NIC offloading features\nsudo ethtool -K eth1 gro off lro off tso off gso off rx off tx off sg off\n\n# Set interface to promiscuous mode\nsudo ip link set eth1 promisc on\n\n# For high-performance deployments, configure AF_PACKET with multiple threads\n# Edit \u002Fetc\u002Fsuricata\u002Fsuricata.yaml\n```\n\n### Step 3: Configure suricata.yaml\n\n```yaml\n# \u002Fetc\u002Fsuricata\u002Fsuricata.yaml (key sections)\n\n# Network variables\nvars:\n  address-groups:\n    HOME_NET: \"[10.0.0.0\u002F8, 172.16.0.0\u002F12, 192.168.0.0\u002F16]\"\n    EXTERNAL_NET: \"!$HOME_NET\"\n    HTTP_SERVERS: \"$HOME_NET\"\n    DNS_SERVERS: \"$HOME_NET\"\n    SMTP_SERVERS: \"$HOME_NET\"\n\n# Default rule path\ndefault-rule-path: \u002Fvar\u002Flib\u002Fsuricata\u002Frules\nrule-files:\n  - suricata.rules\n\n# AF_PACKET configuration for high performance\naf-packet:\n  - interface: eth1\n    threads: auto\n    cluster-id: 99\n    cluster-type: cluster_flow\n    defrag: yes\n    use-mmap: yes\n    ring-size: 200000\n    buffer-size: 262144\n\n# EVE JSON logging (primary output format)\noutputs:\n  - eve-log:\n      enabled: yes\n      filetype: regular\n      filename: eve.json\n      pcap-file: false\n      community-id: true\n      types:\n        - alert:\n            tagged-packets: yes\n            payload: yes\n            payload-printable: yes\n            http-body: yes\n            http-body-printable: yes\n        - http:\n            extended: yes\n        - dns:\n            query: yes\n            answer: yes\n        - tls:\n            extended: yes\n        - files:\n            force-magic: yes\n            force-hash: [md5, sha256]\n        - smtp:\n            extended: yes\n        - flow\n        - netflow\n        - anomaly:\n            enabled: yes\n        - stats:\n            totals: yes\n            threads: yes\n\n  # PCAP logging for captured packets that trigger alerts\n  - pcap-log:\n      enabled: yes\n      filename: alert-%n.pcap\n      limit: 100mb\n      max-files: 50\n      mode: normal\n      use-stream-depth: no\n      honor-pass-rules: no\n\n# Stream engine settings\nstream:\n  memcap: 512mb\n  checksum-validation: no\n  reassembly:\n    memcap: 1gb\n    depth: 1mb\n    toserver-chunk-size: 2560\n    toclient-chunk-size: 2560\n\n# Detection engine\ndetect:\n  profile: high\n  custom-values:\n    toclient-groups: 200\n    toserver-groups: 200\n  sgh-mpm-context: auto\n  inspection-recursion-limit: 3000\n\n# Protocol detection and parsing\napp-layer:\n  protocols:\n    http:\n      enabled: yes\n      memcap: 64mb\n    tls:\n      enabled: yes\n      detection-ports:\n        dp: 443, 8443\n      ja3-fingerprints: yes\n    dns:\n      enabled: yes\n      tcp:\n        enabled: yes\n      udp:\n        enabled: yes\n    smb:\n      enabled: yes\n      detection-ports:\n        dp: 139, 445\n    ssh:\n      enabled: yes\n      hassh: yes\n```\n\n### Step 4: Download and Manage Rulesets\n\n```bash\n# Update Suricata rules using suricata-update\nsudo suricata-update\n\n# Enable additional rule sources\nsudo suricata-update list-sources\nsudo suricata-update enable-source et\u002Fopen\nsudo suricata-update enable-source oisf\u002Ftrafficid\nsudo suricata-update enable-source ptresearch\u002Fattackdetection\n\n# Update with all enabled sources\nsudo suricata-update\n\n# Check rule statistics\nsudo suricata-update list-sources --enabled\nwc -l \u002Fvar\u002Flib\u002Fsuricata\u002Frules\u002Fsuricata.rules\n\n# Disable noisy rules\nsudo tee \u002Fetc\u002Fsuricata\u002Fdisable.conf \u003C\u003C 'EOF'\n# Disable overly broad rules\n2100498\n2013028\n2210000-2210050\ngroup:emerging-policy.rules\nEOF\n\n# Create custom local rules\nsudo tee \u002Fetc\u002Fsuricata\u002Frules\u002Flocal.rules \u003C\u003C 'EOF'\n# Detect reverse shell connections\nalert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:\"LOCAL Reverse Shell Port 4444\"; flow:established,to_server; content:\"|2f 62 69 6e 2f|\"; sid:9000001; rev:1; classtype:trojan-activity; priority:1;)\n\n# Detect DNS tunneling by query length\nalert dns $HOME_NET any -> any any (msg:\"LOCAL DNS Tunneling Long Query\"; dns.query; content:\".\"; offset:50; sid:9000002; rev:1; classtype:policy-violation; priority:2;)\n\n# Detect TLS to suspicious JA3 hash (Cobalt Strike default)\nalert tls $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Cobalt Strike JA3 Hash\"; ja3.hash; content:\"72a589da586844d7f0818ce684948eea\"; sid:9000003; rev:1; classtype:trojan-activity; priority:1;)\n\n# Detect SSH brute force\nalert ssh $EXTERNAL_NET any -> $HOME_NET 22 (msg:\"LOCAL SSH Brute Force Attempt\"; flow:to_server; threshold:type both, track by_src, count 10, seconds 60; sid:9000004; rev:1; classtype:attempted-admin; priority:2;)\n\n# Detect data exfiltration via HTTP POST (large uploads)\nalert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Large HTTP POST Upload\"; flow:to_server,established; http.method; content:\"POST\"; http.content_len; content:\">\"; byte_test:8,>,10000000,0,string; sid:9000005; rev:1; classtype:policy-violation; priority:2;)\nEOF\n\n# Add local rules to configuration\necho \"  - local.rules\" | sudo tee -a \u002Fetc\u002Fsuricata\u002Fsuricata.yaml\n```\n\n### Step 5: Deploy and Validate\n\n```bash\n# Validate configuration\nsudo suricata -T -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml -v\n\n# Run Suricata in IDS mode\nsudo suricata -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml --af-packet=eth1 -D\n\n# Or run in IPS mode (inline with NFQueue)\n# First configure iptables to send traffic to NFQueue\n# sudo iptables -I FORWARD -j NFQUEUE --queue-num 0\n# sudo suricata -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml -q 0 -D\n\n# Create systemd service\nsudo tee \u002Fetc\u002Fsystemd\u002Fsystem\u002Fsuricata.service \u003C\u003C 'EOF'\n[Unit]\nDescription=Suricata IDS\u002FIPS\nAfter=network.target\nRequires=network.target\n\n[Service]\nType=simple\nExecStartPre=\u002Fusr\u002Fbin\u002Fsuricata -T -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml\nExecStart=\u002Fusr\u002Fbin\u002Fsuricata -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml --af-packet=eth1 --pidfile \u002Fvar\u002Frun\u002Fsuricata.pid\nExecReload=\u002Fbin\u002Fkill -USR2 $MAINPID\nRestart=on-failure\n\n[Install]\nWantedBy=multi-user.target\nEOF\n\nsudo systemctl enable --now suricata\n\n# Test with a known signature\ncurl http:\u002F\u002Ftestmynids.org\u002Fuid\u002Findex.html\n# Should trigger ET GPL rule for uid.\n\n# Verify alerts are generated\nsudo tail -f \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq 'select(.event_type==\"alert\")'\n```\n\n### Step 6: Integrate with SIEM and Monitor\n\n```bash\n# Parse EVE JSON with jq for quick analysis\n# Top 10 alerts\ncat \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq -r 'select(.event_type==\"alert\") | .alert.signature' | sort | uniq -c | sort -rn | head -10\n\n# Extract IOCs from alerts\ncat \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq -r 'select(.event_type==\"alert\") | [.timestamp, .src_ip, .dest_ip, .alert.signature, .alert.severity] | @csv' > alert_summary.csv\n\n# JA3 fingerprint analysis\ncat \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq -r 'select(.event_type==\"tls\") | [.src_ip, .tls.ja3.hash, .tls.sni] | @csv' | sort | uniq -c | sort -rn\n\n# DNS query analysis\ncat \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq -r 'select(.event_type==\"dns\" and .dns.type==\"query\") | [.src_ip, .dns.rrname, .dns.rrtype] | @csv' | sort | uniq -c | sort -rn | head -20\n\n# Configure Filebeat for Elastic integration\nsudo tee \u002Fetc\u002Ffilebeat\u002Fmodules.d\u002Fsuricata.yml \u003C\u003C 'EOF'\n- module: suricata\n  eve:\n    enabled: true\n    var.paths: [\"\u002Fvar\u002Flog\u002Fsuricata\u002Feve.json\"]\nEOF\n\nsudo filebeat modules enable suricata\nsudo systemctl restart filebeat\n\n# Monitor Suricata performance\ncat \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq 'select(.event_type==\"stats\") | .stats.capture' | tail -1\n# Check for packet drops: kernel_drops should be 0\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **EVE JSON** | Suricata's primary logging format producing structured JSON events for alerts, protocol metadata, flow records, and statistics |\n| **AF_PACKET** | Linux kernel packet capture mechanism used by Suricata for high-performance traffic capture with kernel-bypass capabilities |\n| **JA3\u002FJA3S** | TLS fingerprinting method that creates hash values from TLS Client Hello and Server Hello parameters for identifying applications and malware |\n| **HASSH** | SSH fingerprinting method similar to JA3 that creates hashes from SSH key exchange parameters to identify SSH client and server implementations |\n| **Community ID** | Standardized flow identifier hash that enables correlation of the same network flow across different monitoring tools (Suricata, Zeek, Wireshark) |\n| **suricata-update** | Official rule management tool that downloads, merges, and manages multiple rulesets with enable\u002Fdisable controls |\n\n## Tools & Systems\n\n- **Suricata 7.0+**: Open-source multi-threaded IDS\u002FIPS\u002FNSM engine with protocol detection, file extraction, and JA3\u002FHASSH fingerprinting\n- **suricata-update**: Ruleset management tool supporting ET Open, ET Pro, Snort rules, and custom rule sources\n- **Elastic Stack (ELK)**: Log aggregation and visualization platform with native Suricata module in Filebeat for dashboards and alerting\n- **Scirius**: Web-based Suricata rule management interface for editing, enabling\u002Fdisabling, and monitoring rule performance\n- **Evebox**: Lightweight event viewer for Suricata EVE JSON logs with alert management and escalation capabilities\n\n## Common Scenarios\n\n### Scenario: Deploying Suricata IDS on a 10 Gbps Enterprise Network Perimeter\n\n**Context**: A technology company needs to deploy IDS at their internet egress point handling 10 Gbps of traffic. They require protocol-level metadata logging for threat hunting, signature-based alerting for known threats, and JA3 fingerprinting for detecting malware C2 communications. Alerts must feed into their Elastic SIEM.\n\n**Approach**:\n1. Deploy Suricata on a server with 16 CPU cores, 64 GB RAM, and dual 10G NICs using AF_PACKET with 14 worker threads\n2. Enable ET Open and ptresearch\u002Fattackdetection rulesets via suricata-update, totaling approximately 35,000 active rules\n3. Configure EVE JSON logging with community-id, extended HTTP\u002FTLS\u002FDNS metadata, and file hashing (MD5 + SHA256)\n4. Enable JA3 and HASSH fingerprinting for TLS and SSH traffic profiling\n5. Write custom rules for organization-specific threats: known bad JA3 hashes, DNS queries to DGA domains, large data uploads to uncommon destinations\n6. Integrate with Elastic via Filebeat's Suricata module, deploying pre-built Kibana dashboards for real-time visibility\n7. Tune rules over a 2-week baseline period, disabling false-positive generators and adjusting thresholds\n\n**Pitfalls**:\n- Not allocating sufficient CPU threads, causing packet drops at peak traffic volumes\n- Enabling all available rules without tuning, overwhelming analysts with false positives\n- Forgetting to disable NIC offloading, resulting in incorrect checksums and missed detections\n- Not enabling community-id, making it difficult to correlate Suricata events with Zeek or other tools\n\n## Output Format\n\n```\n## Suricata IDS Deployment Report\n\n**Sensor**: suricata-gw-01 (10.10.1.251)\n**Interface**: eth1 (span from border router)\n**Configuration**: \u002Fetc\u002Fsuricata\u002Fsuricata.yaml\n**Worker Threads**: 14 AF_PACKET threads\n**Active Rules**: 35,247 (ET Open + Custom)\n\n### Performance Metrics (24-hour)\n\n| Metric | Value |\n|--------|-------|\n| Packets Processed | 847,293,421 |\n| Kernel Drops | 0 (0.000%) |\n| Alerts Generated | 1,247 |\n| Unique Signatures Fired | 89 |\n| JA3 Fingerprints Observed | 342 unique |\n| Files Extracted | 2,847 |\n\n### Top 10 Alert Signatures\n\n| Count | SID | Signature | Severity |\n|-------|-----|-----------|----------|\n| 312 | 2024897 | ET POLICY curl User-Agent Outbound | 3 |\n| 189 | 9000003 | LOCAL Cobalt Strike JA3 Hash | 1 |\n| 145 | 2028765 | ET SCAN Nmap SYN Scan | 2 |\n| 98 | 9000002 | LOCAL DNS Tunneling Long Query | 2 |\n\n### Critical Alerts Requiring Immediate Triage\n1. SID 9000003: Cobalt Strike JA3 from 10.10.5.12 to 203.0.113.50 (189 alerts)\n2. SID 9000002: DNS tunneling from 10.10.3.45 to suspect-domain.xyz (98 alerts)\n```\n","# Configuring Suricata for Network Monitoring\n\n## When to Use\n\n- Deploying a high-performance IDS\u002FIPS capable of multi-threaded packet processing for 10+ Gbps network links\n- Monitoring network traffic with protocol-aware inspection for HTTP, TLS, DNS, SMB, and other protocols\n- Generating structured EVE JSON logs for direct SIEM ingestion without custom parsers\n- Running in inline (IPS) mode to actively block malicious traffic at network choke points\n- Combining signature-based detection with protocol anomaly detection and file extraction\n\n**Do not use** as a standalone security solution without complementary controls, for encrypted traffic inspection without TLS decryption capabilities, or on systems with insufficient CPU\u002Fmemory for the expected traffic volume.\n\n## Prerequisites\n\n- Suricata 7.0+ installed from PPA or source (`suricata --build-info`)\n- Network interface on a span port, tap, or inline bridge for traffic capture\n- AF_PACKET or DPDK support for high-performance packet capture\n- Emerging Threats Open or Pro ruleset subscription (or Snort Talos rules via oinkcode)\n- suricata-update tool for automated rule management\n- Elasticsearch\u002FKibana or Splunk for log analysis and visualization\n\n## Workflow\n\n### Step 1: Install Suricata and Dependencies\n\n```bash\n# Install from PPA (Ubuntu\u002FDebian)\nsudo add-apt-repository ppa:oisf\u002Fsuricata-stable\nsudo apt update\nsudo apt install -y suricata suricata-update jq\n\n# Verify installation\nsuricata --build-info | grep -E \"Version|AF_PACKET|NFQueue\"\n\n# Or install from source for latest features\nsudo apt install -y libpcre2-dev build-essential autoconf automake libtool \\\n  libpcap-dev libnet1-dev libyaml-dev libjansson-dev libcap-ng-dev \\\n  libmagic-dev libnetfilter-queue-dev libhiredis-dev rustc cargo cbindgen\ngit clone https:\u002F\u002Fgithub.com\u002FOISF\u002Fsuricata.git\ncd suricata && git clone https:\u002F\u002Fgithub.com\u002FOISF\u002Flibhtp.git -b 0.5.x\n.\u002Fautogen.sh && .\u002Fconfigure --prefix=\u002Fusr --sysconfdir=\u002Fetc --localstatedir=\u002Fvar \\\n  --enable-nfqueue --enable-af-packet\nmake -j$(nproc) && sudo make install install-conf\n```\n\n### Step 2: Configure Network Interfaces\n\n```bash\n# Disable NIC offloading features\nsudo ethtool -K eth1 gro off lro off tso off gso off rx off tx off sg off\n\n# Set interface to promiscuous mode\nsudo ip link set eth1 promisc on\n\n# For high-performance deployments, configure AF_PACKET with multiple threads\n# Edit \u002Fetc\u002Fsuricata\u002Fsuricata.yaml\n```\n\n### Step 3: Configure suricata.yaml\n\n```yaml\n# \u002Fetc\u002Fsuricata\u002Fsuricata.yaml (key sections)\n\n# Network variables\nvars:\n  address-groups:\n    HOME_NET: \"[10.0.0.0\u002F8, 172.16.0.0\u002F12, 192.168.0.0\u002F16]\"\n    EXTERNAL_NET: \"!$HOME_NET\"\n    HTTP_SERVERS: \"$HOME_NET\"\n    DNS_SERVERS: \"$HOME_NET\"\n    SMTP_SERVERS: \"$HOME_NET\"\n\n# Default rule path\ndefault-rule-path: \u002Fvar\u002Flib\u002Fsuricata\u002Frules\nrule-files:\n  - suricata.rules\n\n# AF_PACKET configuration for high performance\naf-packet:\n  - interface: eth1\n    threads: auto\n    cluster-id: 99\n    cluster-type: cluster_flow\n    defrag: yes\n    use-mmap: yes\n    ring-size: 200000\n    buffer-size: 262144\n\n# EVE JSON logging (primary output format)\noutputs:\n  - eve-log:\n      enabled: yes\n      filetype: regular\n      filename: eve.json\n      pcap-file: false\n      community-id: true\n      types:\n        - alert:\n            tagged-packets: yes\n            payload: yes\n            payload-printable: yes\n            http-body: yes\n            http-body-printable: yes\n        - http:\n            extended: yes\n        - dns:\n            query: yes\n            answer: yes\n        - tls:\n            extended: yes\n        - files:\n            force-magic: yes\n            force-hash: [md5, sha256]\n        - smtp:\n            extended: yes\n        - flow\n        - netflow\n        - anomaly:\n            enabled: yes\n        - stats:\n            totals: yes\n            threads: yes\n\n  # PCAP logging for captured packets that trigger alerts\n  - pcap-log:\n      enabled: yes\n      filename: alert-%n.pcap\n      limit: 100mb\n      max-files: 50\n      mode: normal\n      use-stream-depth: no\n      honor-pass-rules: no\n\n# Stream engine settings\nstream:\n  memcap: 512mb\n  checksum-validation: no\n  reassembly:\n    memcap: 1gb\n    depth: 1mb\n    toserver-chunk-size: 2560\n    toclient-chunk-size: 2560\n\n# Detection engine\ndetect:\n  profile: high\n  custom-values:\n    toclient-groups: 200\n    toserver-groups: 200\n  sgh-mpm-context: auto\n  inspection-recursion-limit: 3000\n\n# Protocol detection and parsing\napp-layer:\n  protocols:\n    http:\n      enabled: yes\n      memcap: 64mb\n    tls:\n      enabled: yes\n      detection-ports:\n        dp: 443, 8443\n      ja3-fingerprints: yes\n    dns:\n      enabled: yes\n      tcp:\n        enabled: yes\n      udp:\n        enabled: yes\n    smb:\n      enabled: yes\n      detection-ports:\n        dp: 139, 445\n    ssh:\n      enabled: yes\n      hassh: yes\n```\n\n### Step 4: Download and Manage Rulesets\n\n```bash\n# Update Suricata rules using suricata-update\nsudo suricata-update\n\n# Enable additional rule sources\nsudo suricata-update list-sources\nsudo suricata-update enable-source et\u002Fopen\nsudo suricata-update enable-source oisf\u002Ftrafficid\nsudo suricata-update enable-source ptresearch\u002Fattackdetection\n\n# Update with all enabled sources\nsudo suricata-update\n\n# Check rule statistics\nsudo suricata-update list-sources --enabled\nwc -l \u002Fvar\u002Flib\u002Fsuricata\u002Frules\u002Fsuricata.rules\n\n# Disable noisy rules\nsudo tee \u002Fetc\u002Fsuricata\u002Fdisable.conf \u003C\u003C 'EOF'\n# Disable overly broad rules\n2100498\n2013028\n2210000-2210050\ngroup:emerging-policy.rules\nEOF\n\n# Create custom local rules\nsudo tee \u002Fetc\u002Fsuricata\u002Frules\u002Flocal.rules \u003C\u003C 'EOF'\n# Detect reverse shell connections\nalert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:\"LOCAL Reverse Shell Port 4444\"; flow:established,to_server; content:\"|2f 62 69 6e 2f|\"; sid:9000001; rev:1; classtype:trojan-activity; priority:1;)\n\n# Detect DNS tunneling by query length\nalert dns $HOME_NET any -> any any (msg:\"LOCAL DNS Tunneling Long Query\"; dns.query; content:\".\"; offset:50; sid:9000002; rev:1; classtype:policy-violation; priority:2;)\n\n# Detect TLS to suspicious JA3 hash (Cobalt Strike default)\nalert tls $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Cobalt Strike JA3 Hash\"; ja3.hash; content:\"72a589da586844d7f0818ce684948eea\"; sid:9000003; rev:1; classtype:trojan-activity; priority:1;)\n\n# Detect SSH brute force\nalert ssh $EXTERNAL_NET any -> $HOME_NET 22 (msg:\"LOCAL SSH Brute Force Attempt\"; flow:to_server; threshold:type both, track by_src, count 10, seconds 60; sid:9000004; rev:1; classtype:attempted-admin; priority:2;)\n\n# Detect data exfiltration via HTTP POST (large uploads)\nalert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Large HTTP POST Upload\"; flow:to_server,established; http.method; content:\"POST\"; http.content_len; content:\">\"; byte_test:8,>,10000000,0,string; sid:9000005; rev:1; classtype:policy-violation; priority:2;)\nEOF\n\n# Add local rules to configuration\necho \"  - local.rules\" | sudo tee -a \u002Fetc\u002Fsuricata\u002Fsuricata.yaml\n```\n\n### Step 5: Deploy and Validate\n\n```bash\n# Validate configuration\nsudo suricata -T -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml -v\n\n# Run Suricata in IDS mode\nsudo suricata -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml --af-packet=eth1 -D\n\n# Or run in IPS mode (inline with NFQueue)\n# First configure iptables to send traffic to NFQueue\n# sudo iptables -I FORWARD -j NFQUEUE --queue-num 0\n# sudo suricata -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml -q 0 -D\n\n# Create systemd service\nsudo tee \u002Fetc\u002Fsystemd\u002Fsystem\u002Fsuricata.service \u003C\u003C 'EOF'\n[Unit]\nDescription=Suricata IDS\u002FIPS\nAfter=network.target\nRequires=network.target\n\n[Service]\nType=simple\nExecStartPre=\u002Fusr\u002Fbin\u002Fsuricata -T -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml\nExecStart=\u002Fusr\u002Fbin\u002Fsuricata -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml --af-packet=eth1 --pidfile \u002Fvar\u002Frun\u002Fsuricata.pid\nExecReload=\u002Fbin\u002Fkill -USR2 $MAINPID\nRestart=on-failure\n\n[Install]\nWantedBy=multi-user.target\nEOF\n\nsudo systemctl enable --now suricata\n\n# Test with a known signature\ncurl http:\u002F\u002Ftestmynids.org\u002Fuid\u002Findex.html\n# Should trigger ET GPL rule for uid.\n\n# Verify alerts are generated\nsudo tail -f \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq 'select(.event_type==\"alert\")'\n```\n\n### Step 6: Integrate with SIEM and Monitor\n\n```bash\n# Parse EVE JSON with jq for quick analysis\n# Top 10 alerts\ncat \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq -r 'select(.event_type==\"alert\") | .alert.signature' | sort | uniq -c | sort -rn | head -10\n\n# Extract IOCs from alerts\ncat \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq -r 'select(.event_type==\"alert\") | [.timestamp, .src_ip, .dest_ip, .alert.signature, .alert.severity] | @csv' > alert_summary.csv\n\n# JA3 fingerprint analysis\ncat \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq -r 'select(.event_type==\"tls\") | [.src_ip, .tls.ja3.hash, .tls.sni] | @csv' | sort | uniq -c | sort -rn\n\n# DNS query analysis\ncat \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq -r 'select(.event_type==\"dns\" and .dns.type==\"query\") | [.src_ip, .dns.rrname, .dns.rrtype] | @csv' | sort | uniq -c | sort -rn | head -20\n\n# Configure Filebeat for Elastic integration\nsudo tee \u002Fetc\u002Ffilebeat\u002Fmodules.d\u002Fsuricata.yml \u003C\u003C 'EOF'\n- module: suricata\n  eve:\n    enabled: true\n    var.paths: [\"\u002Fvar\u002Flog\u002Fsuricata\u002Feve.json\"]\nEOF\n\nsudo filebeat modules enable suricata\nsudo systemctl restart filebeat\n\n# Monitor Suricata performance\ncat \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq 'select(.event_type==\"stats\") | .stats.capture' | tail -1\n# Check for packet drops: kernel_drops should be 0\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **EVE JSON** | Suricata's primary logging format producing structured JSON events for alerts, protocol metadata, flow records, and statistics |\n| **AF_PACKET** | Linux kernel packet capture mechanism used by Suricata for high-performance traffic capture with kernel-bypass capabilities |\n| **JA3\u002FJA3S** | TLS fingerprinting method that creates hash values from TLS Client Hello and Server Hello parameters for identifying applications and malware |\n| **HASSH** | SSH fingerprinting method similar to JA3 that creates hashes from SSH key exchange parameters to identify SSH client and server implementations |\n| **Community ID** | Standardized flow identifier hash that enables correlation of the same network flow across different monitoring tools (Suricata, Zeek, Wireshark) |\n| **suricata-update** | Official rule management tool that downloads, merges, and manages multiple rulesets with enable\u002Fdisable controls |\n\n## Tools & Systems\n\n- **Suricata 7.0+**: Open-source multi-threaded IDS\u002FIPS\u002FNSM engine with protocol detection, file extraction, and JA3\u002FHASSH fingerprinting\n- **suricata-update**: Ruleset management tool supporting ET Open, ET Pro, Snort rules, and custom rule sources\n- **Elastic Stack (ELK)**: Log aggregation and visualization platform with native Suricata module in Filebeat for dashboards and alerting\n- **Scirius**: Web-based Suricata rule management interface for editing, enabling\u002Fdisabling, and monitoring rule performance\n- **Evebox**: Lightweight event viewer for Suricata EVE JSON logs with alert management and escalation capabilities\n\n## Common Scenarios\n\n### Scenario: Deploying Suricata IDS on a 10 Gbps Enterprise Network Perimeter\n\n**Context**: A technology company needs to deploy IDS at their internet egress point handling 10 Gbps of traffic. They require protocol-level metadata logging for threat hunting, signature-based alerting for known threats, and JA3 fingerprinting for detecting malware C2 communications. Alerts must feed into their Elastic SIEM.\n\n**Approach**:\n1. Deploy Suricata on a server with 16 CPU cores, 64 GB RAM, and dual 10G NICs using AF_PACKET with 14 worker threads\n2. Enable ET Open and ptresearch\u002Fattackdetection rulesets via suricata-update, totaling approximately 35,000 active rules\n3. Configure EVE JSON logging with community-id, extended HTTP\u002FTLS\u002FDNS metadata, and file hashing (MD5 + SHA256)\n4. Enable JA3 and HASSH fingerprinting for TLS and SSH traffic profiling\n5. Write custom rules for organization-specific threats: known bad JA3 hashes, DNS queries to DGA domains, large data uploads to uncommon destinations\n6. Integrate with Elastic via Filebeat's Suricata module, deploying pre-built Kibana dashboards for real-time visibility\n7. Tune rules over a 2-week baseline period, disabling false-positive generators and adjusting thresholds\n\n**Pitfalls**:\n- Not allocating sufficient CPU threads, causing packet drops at peak traffic volumes\n- Enabling all available rules without tuning, overwhelming analysts with false positives\n- Forgetting to disable NIC offloading, resulting in incorrect checksums and missed detections\n- Not enabling community-id, making it difficult to correlate Suricata events with Zeek or other tools\n\n## Output Format\n\n```\n## Suricata IDS Deployment Report\n\n**Sensor**: suricata-gw-01 (10.10.1.251)\n**Interface**: eth1 (span from border router)\n**Configuration**: \u002Fetc\u002Fsuricata\u002Fsuricata.yaml\n**Worker Threads**: 14 AF_PACKET threads\n**Active Rules**: 35,247 (ET Open + Custom)\n\n### Performance Metrics (24-hour)\n\n| Metric | Value |\n|--------|-------|\n| Packets Processed | 847,293,421 |\n| Kernel Drops | 0 (0.000%) |\n| Alerts Generated | 1,247 |\n| Unique Signatures Fired | 89 |\n| JA3 Fingerprints Observed | 342 unique |\n| Files Extracted | 2,847 |\n\n### Top 10 Alert Signatures\n\n| Count | SID | Signature | Severity |\n|-------|-----|-----------|----------|\n| 312 | 2024897 | ET POLICY curl User-Agent Outbound | 3 |\n| 189 | 9000003 | LOCAL Cobalt Strike JA3 Hash | 1 |\n| 145 | 2028765 | ET SCAN Nmap SYN Scan | 2 |\n| 98 | 9000002 | LOCAL DNS Tunneling Long Query | 2 |\n\n### Critical Alerts Requiring Immediate Triage\n1. SID 9000003: Cobalt Strike JA3 from 10.10.5.12 to 203.0.113.50 (189 alerts)\n2. SID 9000002: DNS tunneling from 10.10.3.45 to suspect-domain.xyz (98 alerts)\n```\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"nist_csf":52,"subdomain":38,"description":57,"mitre_attack":58},[38,28,37,36,35],"mahipal","1.0",[53,54,55,56],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02","Deploys and configures Suricata IDS\u002FIPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.\n",[59,60,61,62,63],"T1046","T1071.001","T1572","T1048","T1573.001","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fconfiguring-suricata-for-network-monitoring","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill configuring-suricata-for-network-monitoring",{"tool":78,"command":79},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill configuring-suricata-for-network-monitoring",{"tool":81,"command":82},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill configuring-suricata-for-network-monitoring","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fconfiguring-suricata-for-network-monitoring\u002FSKILL.md",true,[86,91,97,103],{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fconfiguring-suricata-for-network-monitoring\u002FLICENSE",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",2627,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fconfiguring-suricata-for-network-monitoring\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",7814,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fconfiguring-suricata-for-network-monitoring\u002Fscripts\u002Fagent.py",{"path":104,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":105,"sourceHtmlUrl":106},"SKILL.es.md",1214,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fconfiguring-suricata-for-network-monitoring\u002FSKILL.es.md",[108,149,158,167,189,215],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":129,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[115,118,121,124],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":125,"categoryName":126,"taxonomyType":127,"taxonomyTypeDesc":128},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[110,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":150,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":157,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[153,154,155,156],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":125,"categoryName":126,"taxonomyType":127,"taxonomyTypeDesc":128},[110,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148],{"skillNo":159,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":166,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[162,163,164,165],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":125,"categoryName":126,"taxonomyType":127,"taxonomyTypeDesc":128},[110,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148],{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[174,175,176,177,178,179,180,181,182,183,184,185,186,187,188],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":196,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[195],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[197,198,199,200,201,202,203,204,205,206,207,141,142,208,209,210,211,212,213,214],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":231,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[221,224,227,228],{"categoryNo":222,"categoryName":223,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":225,"categoryName":226,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":229,"categoryName":230,"taxonomyType":127,"taxonomyTypeDesc":128},"01JBSEEDCAT000000000000036","内容创作者",[232,233,234,235,236,237,238,239,138,240,141,142,143,241,242,243,244,245,188,246],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]